542 lines
15 KiB
JSON
542 lines
15 KiB
JSON
{
|
|
"artifact": {
|
|
"built": false,
|
|
"execution_eligible": false,
|
|
"filename": null,
|
|
"sha256": null,
|
|
"size": null
|
|
},
|
|
"binary_evidence": {
|
|
"disassembly_sha256": "a4af871eb9bf7df57e3f323972616f48dbffaadfea7afb3976404304cc80ca31",
|
|
"dt_needed": [
|
|
"libSceLibcInternal.sprx",
|
|
"libSceNet.sprx",
|
|
"libkernel_web.sprx"
|
|
],
|
|
"entry_point": "0x4700",
|
|
"init_fini_array_sizes": {
|
|
"fini_array": 0,
|
|
"init_array": 0,
|
|
"preinit_array": 0
|
|
},
|
|
"load_segments": [
|
|
{
|
|
"file_size": 51455,
|
|
"memory_size": 51455,
|
|
"permissions": "RWE"
|
|
},
|
|
{
|
|
"file_size": 33104,
|
|
"memory_size": 33104,
|
|
"permissions": "RW"
|
|
},
|
|
{
|
|
"file_size": 264688,
|
|
"memory_size": 267000,
|
|
"permissions": "RW"
|
|
}
|
|
],
|
|
"readelf_report_sha256": "e0526deb23e40a3a8ad6f613dfbc3d5764ceb1cb770ce9e6fa1010c4e83ba9f9",
|
|
"relocations": {
|
|
"relative": 140,
|
|
"total": 164
|
|
},
|
|
"tls_present": false,
|
|
"undefined_dynamic_symbols": [
|
|
"__error",
|
|
"close",
|
|
"execve",
|
|
"free",
|
|
"getpid",
|
|
"kevent",
|
|
"kill",
|
|
"kqueue",
|
|
"malloc",
|
|
"memcpy",
|
|
"memset",
|
|
"open",
|
|
"printf",
|
|
"puts",
|
|
"realloc",
|
|
"recv",
|
|
"rfork_thread",
|
|
"sceKernelSendNotificationRequest",
|
|
"strcmp",
|
|
"strerror",
|
|
"strlen",
|
|
"sysctl",
|
|
"vsnprintf",
|
|
"waitpid"
|
|
]
|
|
},
|
|
"callgraph": {
|
|
"edges": [
|
|
[
|
|
"Payload Manager /loadpayload:<path>",
|
|
"ps5_launch_elf"
|
|
],
|
|
[
|
|
"ps5_launch_elf",
|
|
"connect 127.0.0.1:9021"
|
|
],
|
|
[
|
|
"ps5_launch_elf",
|
|
"send ELF bytes"
|
|
],
|
|
[
|
|
"serve_elfldr",
|
|
"elfldr_spawn"
|
|
],
|
|
[
|
|
"elfldr_spawn",
|
|
"rfork_thread"
|
|
],
|
|
[
|
|
"rfork_thread child",
|
|
"elfldr_rfork_entry"
|
|
],
|
|
[
|
|
"elfldr_rfork_entry",
|
|
"ptrace PT_TRACE_ME"
|
|
],
|
|
[
|
|
"elfldr_rfork_entry",
|
|
"execve SceSpZeroConf"
|
|
],
|
|
[
|
|
"elfldr_spawn parent",
|
|
"pt_syscall 599"
|
|
],
|
|
[
|
|
"elfldr_spawn parent",
|
|
"install then restore INT3 byte"
|
|
],
|
|
[
|
|
"elfldr_spawn parent",
|
|
"elfldr_exec"
|
|
],
|
|
[
|
|
"elfldr_exec",
|
|
"elfldr_raise_privileges"
|
|
],
|
|
[
|
|
"elfldr_exec",
|
|
"elfldr_prepare_exec"
|
|
],
|
|
[
|
|
"elfldr_prepare_exec",
|
|
"elfldr_load"
|
|
],
|
|
[
|
|
"elfldr_prepare_exec",
|
|
"elfldr_payload_args"
|
|
],
|
|
[
|
|
"elfldr_prepare_exec",
|
|
"push observed RIP at RSP-8"
|
|
],
|
|
[
|
|
"elfldr_prepare_exec",
|
|
"set RIP=payload entry"
|
|
],
|
|
[
|
|
"elfldr_prepare_exec",
|
|
"set RDI=payload_args"
|
|
],
|
|
[
|
|
"elfldr_exec",
|
|
"restore subset of credentials"
|
|
],
|
|
[
|
|
"elfldr_exec",
|
|
"ptrace PT_DETACH"
|
|
],
|
|
[
|
|
"payload _start",
|
|
"SDK __patch_init"
|
|
],
|
|
[
|
|
"payload _start",
|
|
"payload main"
|
|
],
|
|
[
|
|
"payload _start",
|
|
"payload_terminate"
|
|
],
|
|
[
|
|
"payload_terminate",
|
|
"return or exit or trap"
|
|
]
|
|
],
|
|
"entry": "Payload Manager /loadpayload:<path>",
|
|
"extraction": "reviewed source edges with required-token assertions"
|
|
},
|
|
"decision": "BLOCKED_VERSION_OR_UNBOUNDED_EFFECT",
|
|
"effects": [
|
|
{
|
|
"blocker": false,
|
|
"classification": "EXPECTED_VOLATILE_RUNTIME_EFFECT",
|
|
"evidence": [
|
|
"elfldr/main.c:48-59"
|
|
],
|
|
"id": "elfldr_first_stage_qaflags_enable",
|
|
"scope": "existing_loader_bootstrap"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/main.c:61-105 restores jail/root/caps/authid",
|
|
"UID is changed by elfldr_raise_privileges but is not backed up or restored"
|
|
],
|
|
"id": "elfldr_first_stage_privilege_restore",
|
|
"scope": "existing_exploit_host_process"
|
|
},
|
|
{
|
|
"blocker": false,
|
|
"classification": "PAYLOAD_PROCESS_LOCAL",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:570-710"
|
|
],
|
|
"id": "payload_process_creation",
|
|
"scope": "new_SceSpZeroConf_child"
|
|
},
|
|
{
|
|
"blocker": false,
|
|
"classification": "RESTORED_BY_LOADER",
|
|
"evidence": [
|
|
"elfldr/pt.c:35-54"
|
|
],
|
|
"id": "ptrace_authid_restore_success_path",
|
|
"scope": "elfldr_service_process"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/pt.c:50-51 returns after failed restoration",
|
|
"no second restoration or process shutdown is present"
|
|
],
|
|
"id": "ptrace_authid_restore_failure_path",
|
|
"scope": "elfldr_service_process"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/pt.c:238-246",
|
|
"elfldr/pt.c:291-299"
|
|
],
|
|
"id": "ptrace_single_step_completion",
|
|
"scope": "loader_control_path"
|
|
},
|
|
{
|
|
"blocker": false,
|
|
"classification": "RESTORED_BY_LOADER",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:675-700"
|
|
],
|
|
"id": "breakpoint_byte",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": false,
|
|
"classification": "PAYLOAD_PROCESS_LOCAL",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:669 changes page to RWX",
|
|
"no source edge restores the original protection"
|
|
],
|
|
"id": "breakpoint_page_permissions",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:447-513 restores jail/root/caps/authid",
|
|
"UID is set to zero and is not restored"
|
|
],
|
|
"id": "payload_credentials",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:143-343",
|
|
"successful detach has no explicit unmap/close cleanup",
|
|
"cleanup depends on an unproven child termination path"
|
|
],
|
|
"id": "payload_mapping_args_sockets_pipes",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": false,
|
|
"classification": "PAYLOAD_PROCESS_LOCAL",
|
|
"evidence": [
|
|
"sdk/crt/crt.c",
|
|
"sdk/crt/patch.c"
|
|
],
|
|
"id": "sdk_patch_init",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"sdk/crt/crt.c payload_terminate may return, call exit, or trap",
|
|
"the exact branch for the injected SceSpZeroConf child is not proven"
|
|
],
|
|
"id": "sdk_termination_branch",
|
|
"scope": "payload_child"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/elfldr.c:703-710 detaches and returns the PID",
|
|
"no 2000 ms watchdog, wait, kill, or retry budget is present"
|
|
],
|
|
"id": "payload_runtime_limit",
|
|
"scope": "detached_payload_child"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"elfldr/socksrv.c:400 ignores SIGCHLD",
|
|
"post-detach exit/resource cleanup semantics are not documented"
|
|
],
|
|
"id": "child_reaping",
|
|
"scope": "elfldr_service_process"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "UNBOUNDED_OR_UNKNOWN",
|
|
"evidence": [
|
|
"pldmgr/http_server.c resolves a path then calls ps5_launch_elf",
|
|
"pldmgr/ps5_launcher.c streams bytes without calculating or checking SHA-256"
|
|
],
|
|
"id": "payload_manager_launch_hash_binding",
|
|
"scope": "payload_manager_to_elfldr"
|
|
},
|
|
{
|
|
"blocker": true,
|
|
"classification": "PERSISTENT_WRITE",
|
|
"evidence": [
|
|
"pldmgr/http_server.c writes /data/pldmgr/payloads/<name>.tmp",
|
|
"the upload is committed into payload storage"
|
|
],
|
|
"id": "payload_manager_upload",
|
|
"scope": "payload_manager_storage"
|
|
}
|
|
],
|
|
"firmware": {
|
|
"device_attested": false,
|
|
"evidence": "user_provided_only",
|
|
"exact": "9.60"
|
|
},
|
|
"hard_blockers": [
|
|
"child_reaping",
|
|
"elfldr_first_stage_privilege_restore",
|
|
"exact_exploit_and_autoloader_identity_unproven",
|
|
"firmware_9_60_not_independently_device_attested",
|
|
"payload_credentials",
|
|
"payload_manager_launch_hash_binding",
|
|
"payload_manager_upload",
|
|
"payload_mapping_args_sockets_pipes",
|
|
"payload_runtime_limit",
|
|
"ptrace_authid_restore_failure_path",
|
|
"ptrace_single_step_completion",
|
|
"return_continuation_after_payload_start_unproven",
|
|
"sdk_termination_branch"
|
|
],
|
|
"identity": {
|
|
"elfldr": {
|
|
"commit": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2",
|
|
"dirty": false,
|
|
"installed_asset_hash_match": true,
|
|
"observed_inventory_path": "/data/pldmgr/payloads/elfldr/elfldr_v0.23.elf",
|
|
"observed_inventory_sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8",
|
|
"observed_inventory_version": "v0.23",
|
|
"release": "v0.23",
|
|
"release_asset_sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8",
|
|
"release_asset_size": 397000,
|
|
"repository": "https://github.com/ps5-payload-dev/elfldr.git"
|
|
},
|
|
"exact_exploit_autoloader": {
|
|
"identified": false,
|
|
"local_candidate": {
|
|
"filename": "Y2JB-Autoloader-403-1240.zip",
|
|
"sha256": "805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291",
|
|
"size": 504159435,
|
|
"status": "local_backup_candidate_not_installed_identity_proof"
|
|
},
|
|
"status": "UNPROVEN"
|
|
},
|
|
"payload_manager": {
|
|
"commit": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1",
|
|
"dirty": false,
|
|
"installed_asset_hash_match": true,
|
|
"observed_inventory_path": "/data/pldmgr/payloads/pldmgr/pldmgr_v0.3.1.elf",
|
|
"observed_inventory_sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b",
|
|
"observed_inventory_version": "v0.3.1",
|
|
"observed_version_endpoint": "0.3.1",
|
|
"release": "v0.3.1",
|
|
"release_asset_sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b",
|
|
"repository": "https://github.com/itsPLK/ps5-payload-manager.git"
|
|
},
|
|
"sdk": {
|
|
"commit": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
|
|
"dirty": false,
|
|
"release": "v0.41",
|
|
"repository": "https://github.com/ps5-payload-dev/sdk.git"
|
|
}
|
|
},
|
|
"no_console_actions": {
|
|
"elf_executed": false,
|
|
"elf_transferred": false,
|
|
"gnm": false,
|
|
"raw_port_9021_contacted": false,
|
|
"rendering": false,
|
|
"videoout": false
|
|
},
|
|
"observation_scope": {
|
|
"date": "2026-07-17",
|
|
"payload_manager_routes": [
|
|
"/autoload_status",
|
|
"/get_config",
|
|
"/list_payloads",
|
|
"/log",
|
|
"/sources_list",
|
|
"/version"
|
|
],
|
|
"payload_manager_routes_read_only": true,
|
|
"strict_status_port_744_result": "ECONNREFUSED"
|
|
},
|
|
"phase": "0.6",
|
|
"schema_version": 1,
|
|
"source_evidence": {
|
|
"elfldr": [
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/main.c",
|
|
"sha256": "51176f0c864af2eb269dff37a7148ec31f72cfa593e7edf85df04685d9639fef",
|
|
"size": 2792
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/elfldr.c",
|
|
"sha256": "2c6ec9f00b346e23bc9fff6b1077072dce7309b59536f420e8578aac9a95fc03",
|
|
"size": 18071
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/elfldr.h",
|
|
"sha256": "48c6840304bf914003d1c9f54efbde7b6ee6317692ddce47443d0c0abf73fe08",
|
|
"size": 1260
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/pt.c",
|
|
"sha256": "8c87c76850587e671b8ad49f1f0e98489a7b1f4bf789da84bcfbb21918d6b046",
|
|
"size": 7489
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/pt.h",
|
|
"sha256": "09a51aef9723f5314b29175875410e55274fa5b4e6708ef7d76599712ae387e4",
|
|
"size": 2391
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/socksrv.c",
|
|
"sha256": "6cc6887969754befa7424da981ea2cc778940c0d45e7bcc7abd99ec1ec39522e",
|
|
"size": 8385
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/elfldr-v0.23/Makefile",
|
|
"sha256": "468ac60791fb09885face7d383d0cf43b0fd7afde1c20fb0984d0bb4999fc6fc",
|
|
"size": 1592
|
|
}
|
|
],
|
|
"payload_manager": [
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/src/ps5_launcher.c",
|
|
"sha256": "082836bfd7a9726f62ea0dad8b7be99a31ab30130bf4f1165bf4bf52acd8673c",
|
|
"size": 4794
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/src/http_server.c",
|
|
"sha256": "362175cb576bcd1e07209987c42fee2cfe515bdd31d1c8588d531570c2ca5a0c",
|
|
"size": 46713
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/src/autoload.c",
|
|
"sha256": "117545fcc3b45e71c97cca2675d772c72fea25523f0ffb66e8b4cf989da32d85",
|
|
"size": 9197
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/src/main.c",
|
|
"sha256": "cd1af1f58f6275828c8a392371ef84a1e9e999a5e76345d0fe8bf3f92f7be51a",
|
|
"size": 7030
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/src/payload_mgr.c",
|
|
"sha256": "65303c3696626fa20eb2d0e7f4da4c51a43d5bc4bc82904f416e7c3b74cf8fb7",
|
|
"size": 18326
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/include/pldmgr.h",
|
|
"sha256": "b1881b943e38a1b8ecdc53e254b0187a011335e5117a36d0ab00e889cb8cb6f5",
|
|
"size": 2450
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/pldmgr-v0.3.1/Makefile",
|
|
"sha256": "6d02de74a46c104da3cd373d51911ebea1137190fe61bc6529403cbac5108004",
|
|
"size": 3675
|
|
}
|
|
],
|
|
"sdk": [
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/sdk/crt/crt.c",
|
|
"sha256": "2695ae6cf23f867849590977e47edfd7743caa8f34255e6de9aa9eae9a4e4ea6",
|
|
"size": 4462
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/sdk/crt/patch.c",
|
|
"sha256": "a9cf1814874f3c2c4b337a23270a80ff159b2e6247f9781018bbe1def1845deb",
|
|
"size": 2184
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/sdk/crt/kernel.c",
|
|
"sha256": "10d2868647b684d7a7f20e029b6a8e792725fa484196a6e00e21c4507469fd12",
|
|
"size": 37992
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/sdk/include/ps5/payload.h",
|
|
"sha256": "752279ee971eee0dc1eda7286a0008caaf7cd34a99c7501d054d40866c0b8fdf",
|
|
"size": 1304
|
|
},
|
|
{
|
|
"normalization": "lf",
|
|
"path": "work/upstream/sdk/crt/Makefile",
|
|
"sha256": "4b4d8856ee05b751888bdc70e7ff146692ced7755644c140ff4a02a3cd154512",
|
|
"size": 1596
|
|
}
|
|
]
|
|
}
|
|
}
|